Service Provider

Background

Versions (since July ‘05) 2.0 (beta expected May ‘06)

Platform cross-platform C++ Microsoft ISS via ISAPI Apache httpd 1.3 & 2.0 Java shib 2.0

Service Provider shibd apache mod_shib Identity Provider

Building it

Binaries Redhat RPMs since 1.3 much easier (if suitable) l l

Documentation Dropped from shib docs as of 1.3 in favour of wiki......but partially missing from wiki select “Shibboleth Web”

Install guide Not part of our original project plan......but in draft.

Dependencies: easy apxs (apache-dev) libssl-dev libcurl-dev Should be available with your O/S

Dependencies: intermediate opensaml libxml-security-c

Dependencies: harder xerces-c via Internet2, bug in upstream log4cpp via Internet2, project in limbo

Other bits Service (/etc/init.d) script steal from the redhat packages if your init.d works the same

First go Hello world local to apache server no internal Auth{N/Z} notion

example

First go set wayfURL to your local IDP self-signed certificates logout?

Authorization

access control by the server by the application by a framework

application-managed

server-managed apache httpd.conf /.htaccess files shibboleth 1.3b XML-based

apache-based Require entity-name [entity-name]

shibboleth-based relatively new, added in 1.3b performance questions

urn:mace:example.edu:exampleEntitlement

dealing with walk-ins “kiosk”-types, e.g. library terminals mod_auth_location on/module.html on/module.html

framework-managed Java AuthN & AuthZ Services (JAAS) Active Directory Federated Services (ADFS) covered later

Use Cases

A real service a local app with internal user auth{N/Z} hack in “trusting” an environment variable e.g. $REMOTE_USER on-the-fly account creation deletion? logout?

Example: sympa mailing list manager attributes via environment variables app-configurable mapping authorization handled by apache a canonical URL defined by sympa

Sympa’s logout two-stage login: authenticated by shibboleth explicitly asked to be “logged in” (demo)

external services shibboleth/apache front-end “black-box” back-end e.g. proxying (via mod_proxy) or fastCGI

Service Provider shibd apache mod_shib Identity Provider

back-endfront-end apache mod_shib shibd mod_proxy Identity Provider

mod_proxy front-end ProxyPass /jon ProxyPassReverse /jon AuthType shibboleth ShibRequireSession on Require valid-user

On the back-end Order deny,allow Deny from all Allow from shib-front-end.ncl.ac.uk

Shortcomings IP spoofing on the back-end cookie scope certificate scope

example again